prevent CNAME/PTR parsing from reading data past the response end

[musl] / src / network / getnameinfo.c

diff --git a/src/network/getnameinfo.c b/src/network/getnameinfo.c
index 588ed76..080d3c0 100644 (file)
--- a/src/network/getnameinfo.c
+++ b/src/network/getnameinfo.c
@@ -2,19 +2,16 @@
 #include <limits.h>
 #include <string.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <net/if.h>
 #include <ctype.h>
+#include <resolv.h>
 #include "lookup.h"
 #include "stdio_impl.h"
 
-int __dns_parse(const unsigned char *, int, int (*)(void *, int, const void *, int, const void *), void *);
-int __dn_expand(const unsigned char *, const unsigned char *, const unsigned char *, char *, int);
-int __res_mkquery(int, const char *, int, int, const unsigned char *, int, const unsigned char*, unsigned char *, int);
-int __res_send(const unsigned char *, int, unsigned char *, int);
-
 #define PTR_MAX (64 + sizeof ".in-addr.arpa")
 #define RR_PTR 12
 
@@ -96,7 +93,7 @@ static void reverse_services(char *buf, int port, int dgram)
                if ((p=strchr(line, '#'))) *p++='\n', *p=0;
 
                for (p=line; *p && !isspace(*p); p++);
-               if (!p) continue;
+               if (!*p) continue;
                *p++ = 0;
                svport = strtoul(p, &z, 10);
 
@@ -111,13 +108,12 @@ static void reverse_services(char *buf, int port, int dgram)
        __fclose_ca(f);
 }
 
-static int dns_parse_callback(void *c, int rr, const void *data, int len, const void *packet)
+static int dns_parse_callback(void *c, int rr, const void *data, int len, const void *packet, int plen)
 {
-       char tmp[256];
        if (rr != RR_PTR) return 0;
-       if (__dn_expand(packet, (const unsigned char *)packet + 512,
-           data, tmp, sizeof tmp) > 0)
-               strcpy(c, tmp);
+       if (__dn_expand(packet, (const unsigned char *)packet + plen,
+           data, c, 256) <= 0)
+               *(char *)c = 0;
        return 0;
        
 }
@@ -136,13 +132,13 @@ int getnameinfo(const struct sockaddr *restrict sa, socklen_t sl,
        switch (af) {
        case AF_INET:
                a = (void *)&((struct sockaddr_in *)sa)->sin_addr;
-               if (sl != sizeof(struct sockaddr_in)) return EAI_FAMILY;
+               if (sl < sizeof(struct sockaddr_in)) return EAI_FAMILY;
                mkptr4(ptr, a);
                scopeid = 0;
                break;
        case AF_INET6:
                a = (void *)&((struct sockaddr_in6 *)sa)->sin6_addr;
-               if (sl != sizeof(struct sockaddr_in6)) return EAI_FAMILY;
+               if (sl < sizeof(struct sockaddr_in6)) return EAI_FAMILY;
                if (memcmp(a, "\0\0\0\0\0\0\0\0\0\0\xff\xff", 12))
                        mkptr6(ptr, a);
                else
@@ -162,6 +158,7 @@ int getnameinfo(const struct sockaddr *restrict sa, socklen_t sl,
                        unsigned char query[18+PTR_MAX], reply[512];
                        int qlen = __res_mkquery(0, ptr, 1, RR_PTR,
                                0, 0, 0, query, sizeof query);
+                       query[3] = 0; /* don't need AD flag */
                        int rlen = __res_send(query, qlen, reply, sizeof reply);
                        buf[0] = 0;
                        if (rlen > 0)